Technical Tip: Cannot upload the IPS database manually from the GUI without internet connection to FortiGate

Description

This article describes how to install the IPS database.

The IPS database update button (Go to System -> FortiGuard -> Upgrade Database/Package) is now only available if the unit is licensed and connected to the internet.

Note:

If there is no internet connection in the unit, there is no way to determine if they have a valid license or not.

Scope

FortiGate.

Solution

Install the IPS database offline; it can be achieved via CLI only:
Download the IPS database from the Support -> Support -> Download -> Service Updates -> then download 'Attack Definition'.

Install the TFTP server on one of the LAN PC, which has a connection to the FortiGate. Store the IPS database file in the TFTP server and then run the following command on the FortiGate.

Ensure a valid network path from FortiGate to the TFTP server; check via the routing table using the command below:

get router info routing-table details <tftp server IP>

execute ping <tftp server IP>

In a multi-VDOM environment, the TFTP restore needs to be done in the global VDOM; however, ensure that other VDOMs have a valid route towards the TFTP server prior to that.

CLI:

config global 
execute restore ips tftp <file name> <tftp IP address> 

Install an IPS update from a TFTP server:

execute restore ips tftp  Restore IPS database from TFTP server.
{string}   IPS database file name on the TFTP server.
{ip}   IP address.

Syntax:

execute restore ips tftp <database_file_name> <TFTP server IP>

For example:

execute restore ips tftp nids_OS6.2.0_14.00655.NIDS.pkg 1.2.3.5

Related articles:
Technical Tip: How to manually upgrade the IPS Engine

Technical Tip: How to downgrade or rollback IPS engine or FMWP Database